The following Security Advisories and program updates have been released this weekend (September 3, 2005):
<h1>Microsoft</h1>
Subject: Microsoft Security Advisory (897663)
http://www.microsoft.com/technet/security/advisory/897663.mspx
Windows Firewall Exception May Not Display in the User Interface
Microsoft has received a report of an unexpected behavior in the way
that the Windows Firewall User Interface handles malformed entries in
the Windows Registry. By creating malformed Windows Firewall exception
entries in the Windows Registry, an exception could be created in the
firewall that would not be displayed in the Windows Firewall User
Interface. However, this exception is displayed by the command line
firewall administration tools.
It is important to note that this is not a vulnerability.
Administrative privileges are required to access the associated
section of the Windows Registry that contains this configuration
information. By using documented methods to manage and create Windows
Firewall exceptions, it is unlikely that a malformed registry entry
will be produced which would exhibit this behavior. It is more likely
that an attacker who has already compromised the system would create
such malformed registry entries with intent to confuse a user.
Microsoft plans to include an update to address this concern as part
of a future service pack on the affected supported platforms.
Workarounds
Microsoft has tested the following workaround. While this workaround
will not correct the underlying issue, it will allow administrators to
view a complete list of defined exceptions.
View Windows Firewall Exceptions by using Netsh Firewall
1. Click Start, click Run, type cmd, and then click OK.
2. Type netsh firewall show state verbose = ENABLE, and then click OK.
3. Search the output text for the following text:
Ports currently open on all network interfaces
The ports and programs that are listed in the Ports currently open on
all network interfaces section are unblocked. Additionally, these
unblocked ports and programs represent enabled program or port exceptions.
<hr>
<h2>Microsoft AntiSpyware Beta definitions update</h2>
Microsoft® Windows AntiSpyware (Beta)
Definitions update to version 5751
Updated 9/1/2005
update via the program updater
<hr>
<h1>SpywareBlaster</h1>
Latest: 09/02/05
Items : 4349
Change: +273 entries
Download:
Use SpywareBlaster's update function
<hr>
<h1>Spybot S&D update</h1>
2005-09-02
Hijacker
+ AdultStore + Wild Media + TNS-Search + ShoptAtHome + 180Search.Solutions
Malware
+ Spy Sheriff + AbetterInternet.Aurora + Smitfraud-C. + SurfSideKick
Spyware
+ WhenU.Search.Desktoptoolbar + Exact Advertising.BargainsBuddy
Trojan
+ CnsMin.ZsMod + CnsMin + Yahoo.YiSouBar + RouterLayer.TDL ++ QDiagHUpdate
Total: 262490 fingerprints in 28746 rules for 1672 products.
Download:
Use Spybot's update function
If you get a bad checksum message while trying to download updates select a different download location from the flyout list. The Spybot home location (Safer Networking) is usually the best source. This is a known issue
<hr>
<h3>Beware of online and phone scams revolving around the Hurricane Katrina Disaster</h3>
«In the wake of hurricane Katrina, several online scams have begun to
circulate the Internet, according to several security firms. Sophos
warned users on Thursday not to open a malware-Infected e-mail posing
as news on the disaster.
Possible subject lines of the e-mail could be "Re: g8 Tropical storm
flooded New Orleans", "Re: g7 80 percent of our city underwater", and
"Re: q1 Katrina killed as many as 80 people". The group said there
could be additional variants.
BetaNews on Thursday morning had received a variant of the above
e-mails, however it appeared that the variance is the letter and
number combination following the "Re:" prefix.
In the body of the message, clicking on the "Read More.." link will
take the user to a malicious Web site that poses as a news story. In
reality, the site uses code to exploit vulnerabilities within Internet
Explorer to install malware including the Troj/Cgab-A Trojan horse.
From there, the attacker could remotely access the user's computer.
"Receiving or reading the emails themselves does not mean you are
infected," Graham Cluley, senior technology consultant for Sophos said.
The SANS Institute is reporting that there are several e-mails
soliciting donations through a Paypal link. According to SANS, it may
be difficult to tell whether the e-mail is from a legitimate organization.
"The hurricane is a dreadful natural disaster, and it's sickening to
think that hackers are prepared to exploit the horrendous situation in
an attempt to break into computers for the purposes of spamming,
extortion and theft," added Cluley.
After discovery of the sites yesterday, several have been removed.
"There are now about 230 .com domains that contain the strings
'katrina' and 'hurricane'. We will make a list of more domains like
this public soon to ask for your help to review them," SANS said on
its Web site.»
Source:
http://www.betanews.com/article/Online_Scams_Exploit_Katrina_Disaster/1125604622
<hr>
Symantec LiveUpdate 2.7.38
This version fixes a security issue.
More Info:
http://securityresponse.symantec.com/avcenter/security/Content/2005.09.02.html
Download:
http://www.symantec.com/techsupp/files/lu/lu.html
<hr>
Posted by Wiz<font size="1" color="#8e236b"><p align="center">[This message was edited by Wiz Feinberg on 04 September 2005 at 07:58 AM.]</p></FONT><font size="1" color="#8e236b"><p align="center">[This message was edited by Wiz Feinberg on 04 September 2005 at 08:00 AM.]</p></FONT><font size="1" color="#8e236b"><p align="center">[This message was edited by Wiz Feinberg on 04 September 2005 at 01:06 PM.]</p></FONT>
Bill